Mirrors/unleash.unleash
1
0
Fork 0
mirror of https://github.com/Unleash/unleash.git synced 2025-02-04 00:18:01 +01:00
Code Issues Projects Releases Wiki Activity

Hyperlink Injection in People Invitation Emails (#2307)

Browse Source 
* Strip special characters

* Allow hyphens
This commit is contained in:
sjaanus 2022-11-01 09:38:33 +01:00 committed by GitHub
parent f1634bb524
commit c501fb221c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/lib/services/email-service.test.ts
View File

@ -80,3 +80,24 @@ test('Can supply additional SMTP transport options', async () => {
},
});
});
test('should strip special characters from email subject', async () => {
const emailService = new EmailService(
{
host: 'test',
port: 9999,
secure: false,
sender: 'noreply@getunleash.ai',
smtpuser: '',
smtppass: '',
},
noLoggerProvider,
);
expect(emailService.stripSpecialCharacters('http://evil.com')).toBe(
'httpevilcom',
);
expect(emailService.stripSpecialCharacters('http://ööbik.com')).toBe(
'httpööbikcom',
);
expect(emailService.stripSpecialCharacters('tom-jones')).toBe('tom-jones');
});

11
src/lib/services/email-service.ts
View File

@ -138,7 +138,12 @@ export class EmailService {
): Promise<IEmailEnvelope> {
if (this.configured()) {
const year = new Date().getFullYear();
const context = { passwordLink, name, year, unleashUrl };
const context = {
passwordLink,
name: this.stripSpecialCharacters(name),
year,
unleashUrl,
};
const bodyHtml = await this.compileTemplate(
'getting-started',
TemplateFormat.HTML,
@ -222,4 +227,8 @@ export class EmailService {
configured(): boolean {
return this.sender !== 'not-configured' && this.mailer !== undefined;
}
stripSpecialCharacters(str: string): string {
return str?.replace(/[`~!@#$%^&*()_|+=?;:'",.<>\{\}\[\]\\\/]/gi, '');
}
}